Issue   

When Authentication Profile or OIDC Authentication Service rules are migrated (through RAP/import/export, Deployment Manager, or other promotion mechanisms) from one environment to another, the imported rule may fail to decrypt the stored client secret in the target environment. This results in authentication failures when the rule is used. 

Symptoms and Impact

Migration of these rules leads to cryptography operation failures and exceptions during authentication.  

The following errors are observed in the logs:

• PRRuntimeException: cryptography operation failed, mode:2
• BadPaddingException: Failed to decrypt encrypted data

Authentication flows that depend on the affected Authentication Profile or OIDC Authentication Service fail until the secret is corrected. 

Steps to reproduce

1. Migrate an Authentication Profile or OIDC Authentication Service rule from one environment to another.
2. Use the imported rule in the target environment. Observe that the imported rule may fail to decrypt the stored client secret in the target environment. Additionally, observe authentication failures when the affected Authentication Profile or OIDC Authentication Service is used.

Root Cause

Client secrets stored within Authentication Profile and OIDC Authentication Service rules are encrypted using environment-specific cryptographic material. When these rules are migrated to another environment, the encrypted secret cannot be decrypted in the target environment, resulting in authentication failures and cryptography-related exceptions. 

This behavior is expected from a security perspective because encrypted secrets are intentionally tied to the environment in which they were created. 

Solution

Workaround

After importing the rule into the target environment, perform the following steps: 

1. Open the affected Authentication Profile or OIDC Authentication Service rule 
2. Re-enter the Client Secret and Client ID if required 
3. Save the rule 
4. Retest the authentication flow. This regenerates the encrypted secret using the cryptographic context of the target environment and restores functionality.  

Resolution

Adopt the Bring Your Own Secrets (BYOS) capability for storing and retrieving authentication credentials.  

With BYOS, sensitive secrets such as OAuth client secrets are maintained in an external secrets management solution and retrieved at runtime when required. Because the secret itself is not migrated as part of the Authentication Profile or OIDC Authentication Service rule, environment-to-environment promotion no longer results in secret decryption failures caused by environment-specific encryption. This removes the dependency on manually re-entering secrets after deployment.  

Organizations that require automated promotion across environments should consider using BYOS to externalize secret storage and eliminate migration-related secret portability issues.  

References

Take Control of Your Secrets: Introducing Bring Your Own Secrets (BYOS) in Pega